Deploy using Terraform | Pure CBS on Azure

Local or Virtual Machine

The machine running Terraform code whether its local machine or an Azure VMIt has to have two characteristics: 

1. Has connectivity to CBS Azure VNet network mentioned in the previous section. 
2. Can authenticate to Azure using one of the methods listed below: Azure CLI or Azure Service Principle.  

Install Terraform

Download and install the appropriate Terraform package for your operating system and hardware architecture via the link below:

https://www.terraform.io/downloads.html

Download CBS Terraform provider files

Create a new directory for the Terraform deployment, and copy or download Terraform provider sample for CBS Azure (Three files shown on the screenshot)from the below link: 

https://github.com/PureStorage-OpenConnect/terraform-provider-cbs/tree/main/examples/azure_array

Authenticate to Azure

There are two ways to authenticate to an Azure account:

1. Azure CLI

Download and install the latest version of the Azure CLI tool via the link below: 

https://docs.microsoft.com/en-us/cli/azure/install-azure-cli

For authentication, log in to the Azure CLI:

az login

And list the Subscriptions associated with the account:

az account list

if the user logging in has more than one Subscription. Specify the Subscription to be the default:

az account set --subscription="SUBSCRIPTION_ID"

2.Azure Service Principal

Terraform can be authenticated with a Service Principal in the provider configuration under main.tf file by adding the following:

provider "cbs" {
    azure {
        client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        client_secret = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        subscription_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        tenant_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    }
}

Key Vault

Along with the infrastructure components defined in the CBS Prerequisite, an Azure Key Vault is required to deploy Cloud Block Store in Azure using Terraform. An existing Key Vault may be used, or a new one can be created for the array. Multiple arrays may reuse the same Key Vault.

Any Azure account that wishes to use Terraform to perform management operations on the array must be granted Get, Set, Delete, List, and Recoverpermissions on secrets within the Key Vault. All secrets created or accessed by the CBS Terraform Provider will use a cbs- prefix.

An example Key Vault creation using the azurerm_key_vault resource from the azurerm provider is shown below. 

## Add This snippet to main.tf
data "azurerm_client_config" "client_config" {}

// Key Vault name must be globally unique
resource "random_id" "vault_id" {
    byte_length = 8
}

resource "azurerm_key_vault" "cbs_key_vault" {
    name                        = "cbs-${random_id.vault_id.hex}"
    location                    = "location_xxxx"
    resource_group_name         = "resource_yyyy"
    tenant_id                   = data.azurerm_client_config.client_config.tenant_id

    sku_name = "standard"

    access_policy {
        tenant_id          = data.azurerm_client_config.client_config.tenant_id
        object_id          = data.azurerm_client_config.client_config.object_id
        secret_permissions = ["Get", "Set", "Delete", "List", "Recover"]
  }
}

User Managed Identity

After Purity 6.4.7, CBS deployment would require passing a user managed identity with specific role permissions. In order to configure the Azure role assignment and create a user managed identity within Terraform, you can copy the example below to main.tf  which is following Azure least privilege access. More information about User Managed Identity in implementing guide.  
 

data "azurerm_subscription" "primary" {
}


resource "azurerm_user_assigned_identity" "user_identity" {
  location            = var.resource_group_location
  resource_group_name = var.resource_group_name
  name                = format("%s%s", var.resource_group_name, "user-assigned-identity")
  tags                = var.tags
}


data "azurerm_resource_group" "rg_id" {
  name = var.resource_group_name
}

resource "azurerm_role_definition" "cbs_role" {
  name  = format("%s%s", var.resource_group_name, "cbs-custom-role-definition")
  scope = data.azurerm_resource_group.rg_id.id


  permissions {
    actions     = ["Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action"]
    not_actions = []
  }
}


resource "azurerm_role_assignment" "role_assignment" {
  scope                = var.cbs_vnet_id
  role_definition_name = azurerm_role_definition.cbs_role.name
  principal_id         = azurerm_user_assigned_identity.user_identity.principal_id
}

Private Key

In order to set up long term management of new arrays, the provider must obtain access to the array during deployment in order to obtain management credentials. In order to accomplish this, the provider must be supplied a private SSH key, either a file path to the key with the pureuser_private_key_path parameter or the key text itself with the pureuser_private_key parameter. The management credentials are stored in the Azure Key Vault that is specified by the key_vault_id parameter. To retrieve the credentials, the provider requires access to the management port of the array, and therefore the machine running Terraform must be able to access the management subnet used for the array.